Telecommunication Operators use a number of systems to manage, monitor and optimize their network including Element Management Systems (EMSs), Network Management Systems (NMSs), Operational Service Systems (OSSs), Policy Charging Rules Function (PCRF), Policy Charging Enforcement Function (PCEF), Deep Packet Inspection (DPI) devices, and Network Probes.
FIG. 1 depicts a 3GPP Long-term Evolution Network separated by management plane 10, enhanced packet core network 20, and radio access network 30. Traditionally, network management resides in the management plane 10 represented by EMSs, NMS, and OSS, which would monitor and control network elements (e.g. PGWs, SGWs, MMEs, eNodeBs, and PE routers) through out-of-band management channel represented by dotted lines in FIG. 1. EMSs are used to manage particular vendor equipment, or class of equipment. NMS and OSS are used to roll-up different EMS views, and provide an environment to capture operational, administrative, management, and provisioning (OAMP) work flows, respectively. These workflows usually fall into one or more of the following categories: Fault Management, Configuration Management, Accounting, and Performance Management. Fault management is used to highlight immediate problems in a network through stateful or threshold crossing alarms. Configuration Management is used to enable, disable or modify functionality across one or more network elements (e.g. PGW, SGW, or eNodeB). Accounting Management is used to track the billing activity of operator's customers. Performance management is used to measure current network health, and provide the necessary visibility into growth.
The OSS/NMS/EMS system is used for fault isolation and resolution, determining whether system performance is declining, upgrading or deploying additional resources, or monitoring consumption of the network.
Over time, other systems were introduced to provide further visibility and control in the network including Network Probes, Deep Packet Inspection devices, Policy Charging Rule Functions (PCRFs) and Policy Charging Enforcement Functions (PCEFs). FIG. 2 illustrates the addition of 3GPP Policy Charging & Control (PCC) Architecture, which transcends the management plane 10 by introducing devices into the control and user plane as enforcement functions. This extends network management driven by OSS, to include control down to subscriber and subscriber's application level. This process was achieved by defining functions for collection, rule analysis and enforcement. The collection and enforcement functions may be centralized or distributed but the rules functions are centralized. The policy driven process works as follows: (1) analyze network and subscriber behavior by taking in data from Network Probes and DPIs, (2) determine policy threshold matching rules and enforcements in the PCRF and PCEF, (3) deploy rules, and (4) enforce actions when thresholds are reached. Due to the centralized nature of this function it only scales well for certain applications and requires the introduction of 3GPP Diameter Routers (DRs) as a front-end load balancer to the PCRFs from all of the various PCEFs such as optimization platforms, core mobile network elements, RAN mobile network elements and deep packet inspection devices.
FIG. 3 illustrates a more recent approach to use offline Analytics to manage the overwhelming amount of data collected by EMSs, NMSs/OSSs, Network Probes, DPI devices, PCEFs, PCRFs, and logging from a multitude of network elements and systems that do not fall into the previous mentioned network devices. Using this data, the network operator is able to move all of the data into a database, usually after several layers of transformations, to get a better understanding of the current network and trends (descriptive analytics) and/or use the past history and trending to determine what may happen in the future (predictive analytics). This means extracting the data, transforming the data into something manageable/consumable, and loading the data into a database for online/offline processing.
When a user initiates connectivity with a mobile network, the user's device (UE) first establishes a signaling connection through the RAN with the mobile network, and establishes Radio Access Bearer (RAB) for transferring user data from/to the user through the RAN, Mobile Core Network (CN) to the internet. Such RABs are established and removed within the RAN on a need basis to conserve Radio and Network Resources. Establishing and removal of RABs is not visible outside of the RAN and thus invisible to the devices beyond the operator's RAN. User's behavior and experience while accessing internet content through the Mobile Network, and the mobile network and RAN behavior as a number of user applications access the network is dependent on types of applications, coverage area and channel quality provided by the RAN to the user applications, time of day, congestion points within the network, device characteristics, mobile device operating system and application versions and so on.
For example, to determine, correct (or prevent) frequent loss of connectivity to the network, several dimensions need to be considered before it can be isolated to the RF conditions of the home area network or a recent device OS upgrade, where nearly all of these aspects are outside the scope of the RAN.
These aspects are not visible by the prior art in part, or in whole, due to the volume of data, tight timing constraints, and combinations of data elements and KPIs. Prior art data collection, analytics and reporting methods collect user data at several locations, import the data to a central database, and then run analysis tools to identify behavior of users, behavior of sites, behavior of devices, trending reports etc.
The prior art is inherently open loop and follows a common architectural principle of collecting known data to a central database or repository, analyzing or processing centralized data based on rigid definition, and performing corresponding fixed actions based on that centralized view. The prior art lacks the ability to inspect large amounts of fine-grained data (e.g. inter-packet gap between messages), with low latency (e.g. 1-10 seconds), and allow the flexibility to introduce new relationships (for example dynamic methods by which data reduction and database importing methods are driven by analytics/reporting queries).
The current invention identifies storing the correlated data from multiple protocols in unstructured form to retain the majority of the information that is envisioned to be needed, running reduction methods on portions of distributed data (inter-related protocol data from different network elements), and running additional reduction methods supplied by Analysis and Reporting Node (ARN) on a demand basis at the data collection points (DNs), and then importing to database. The database may be centrally located close to the ARN node, or layered on a distributed file system that is spread between the ARN and DN nodes. These methods of importing data into a database are known in the prior art and outside the scope of the current invention. The current invention enables a class of application use cases by aligning the computation model with the underlying network structure while still managing the overall amount of data. Another embodiment of the current invention is “closed loop analytics”, that includes (1) exporting additional fine-grain data already collected in the DNs on a need basis by detecting anomalies and threshold crossing on performance metrics from plurality of DNs, for example, a number of eNodeB's covering a venue, or airport, (2) exporting methods and procedures to collect additional fine-grain data which were not previously incorporated into the device previously, (3) exporting methods and procedures to reduce the newly collected data together with the remaining data to derive new consolidated metrics and/or minimize the amount of data to be exported. These fine-grain drill-down collection and analysis methods may be automatically invoked by the ARN based on the network-wide anomaly detection, and/or operator initiated query.